ca2164d8bcb3d92cac88f0d0e33e093e5b69450680c27c8db67330ad698b02de

Analysis

max time kernel
131s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d68b741e2f324c916b02685fdd67e62c_JaffaCakes118.html
Size

6KB
MD5

d68b741e2f324c916b02685fdd67e62c
SHA1

440dbb7589116107cbde36d62907da31270ac688
SHA256

ca2164d8bcb3d92cac88f0d0e33e093e5b69450680c27c8db67330ad698b02de
SHA512

d57cb504bd91f411126132b940b56a2f3c0430e885710d155c80663b81a7be9918834054b099da9cbdde1fde145358bf244f02ff6a94db179e5c6a43b7518dff
SSDEEP

96:uzVs+ux7gzLLY1k9o84d12ef7CSTUaZcEZ7ru7f:csz7gzAYS/tb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000004c32c43f290e02c911b7173a9859296679c9dedf2b5a613b8f306b90d5696e01000000000e80000000020000200000002860a42e7339e336c5b7793f9b187c271cb5ac59bd5c4a0581246f00ddf1f65720000000d1b8b4b3b27065b3d1f8419bf2203a252b6bd422649ec3b0b675b8d6575f9dc6400000007eb3bd54c99a57c6fbf122f4851f45ddeec6eba64a08befc60de1f432690461f03be8cf8543fa5cd7be234bf624b2c6bddd1b9391ac0542deb608c016ce537f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432055441"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b9cf3dc802db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D841001-6EBB-11EF-B2D5-C6DA928D33CD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000049c0822e027692e7c0cbfe4da96ce3a4f8a769f8e1018c93bc5d83124378857c000000000e8000000002000020000000cc25309ee119c13d6342744ddbac89d18a2aae6525cf28e2144953229796a460900000005d75152137f440e675b76498f1c763091357cf383369b9e041a6875bb50ecd07456f6f43b6b4b00e686f35c4b2aa96253481f851ab9d394252e6417bde1536c9c0453c7057dea9785fe3662bc42f90ce7349f2212f61d97d0424c071822bcb483aa0f39f3c4f82c253c05c8e7385172b74cf4fd47495e75226eb9671e942519fd90d361f59e825f82a65cdba6fb6c81e40000000d6a427005e7067cad36db5f93d2bb47176918c144d17c5f865c4487eeff17598e1bfdf6756506ef4109b1110d33d6d64997585ccae00829c35b7954c1623815d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2704	iexplore.exe
2704	iexplore.exe
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2672	2704	iexplore.exe	30
PID 2704 wrote to memory of 2672	2704	iexplore.exe	30
PID 2704 wrote to memory of 2672	2704	iexplore.exe	30
PID 2704 wrote to memory of 2672	2704	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d68b741e2f324c916b02685fdd67e62c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cfc82cf3b07872d659691dfa260c9a2

SHA1
980beb9b948ec1f36811ae2d2762149729c6a5c8

SHA256
db516e0484d1f1f10ceb560f09b57d800ea4007584de6da2892cc02514f3e377

SHA512
b1a9f4c7fd51daa7d3a195fda04adf4841431559ef2d12f1fc92cb4cf3634a4b422a959bacc629204170234eb143258d6094630ec975da898198591b95cb9c7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f9146ac57067040dbc53ab1ae4bd2e6

SHA1
296442f470b6ab242c23a753021b838f035b4621

SHA256
302c93fef4fbd178ca677734a8d8222f8980edfd66b941fe676cc56551cfa183

SHA512
bcbaaf46c0bbb8ab3d550e5c06c594d413264562dd7a7b0ea977ba9975b3b9e508878a4e4aca165c0fc9cb82a186fe64ec13e3f7a9e7e17c3863408c53c09bab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6116877978c9cb791b0905e7890be3c8

SHA1
27f789935b5e4d703ec2b0ce33fbe9ef835f455a

SHA256
a855b2af9faf4339293b77d2e5e80cbedfa947c6bf22c7f1075ec39f9570712f

SHA512
d2907251cd4e14d6ccd4852d1280a7d302845a068b43b939b2c2293dc4d679adf74814299ee828c9e587bdcc0e8daacb312bd27e7109cd8db84399d9c0f5e914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abdbcdf6ce289f885d84e6eb41182409

SHA1
83133e25f281ad88b10078ea3e7946a4ab5672d3

SHA256
9fdb3cff14a7491924d2f60f033de0c666c79b081f213529a6bcee5880663d58

SHA512
f2eb5956289758549bac87ccc8314ad7c1c7f462cab4ef0d89b28392aef0ecec83e3a7e4a2678561e48d78a7ad0521de4484d6158529d6c38bdd543ab8484441

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92a3358cb33257d8d86af2f2822b362b

SHA1
f9b50fb95bc5262c183dc9ef3a2c3a0af277c0d8

SHA256
3aeb081e07c4accddf1f4a89ee4f4b675c5847edbd103e2db4ab1c512268772b

SHA512
4f76da2163ed3f1867f8f74ab2a18bf9151d5e2d9783090c2e23e3dbce149669dfe44ac83c1279a092edae8eaaf69ba8ce53cf4492b13c2e84bdde1341625de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61e54e1401d3897a0465249d89b4474c

SHA1
c60de5f5aef66bcb98517552e67d79016cbd5707

SHA256
f5e2dd164dc8263186d356a95c13e610ae64b1293de742a64907b8269c85e4c1

SHA512
49cb4845c984c3742ad709ca1965faffc0811644ee171c4fbe70350a1424374147a5d2de323a5e67d1f377fc1a4ebd114d391f6e6a0f0bd2b9d4d45646c28a4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ede04cbd0f480897f0ee71d0a48b3f2b

SHA1
f02818de782f4027b9951f0689adea442e243fd9

SHA256
ca12bfebccd54e8a4a2b95bedb62d7aec78d01f68b64ae901ca1d8860268cba8

SHA512
9a85df583a8f6415fca692084cf42e45ef2db3abb29dbc18bfa5550657b293fcfd7aa3ed4095baa3396718bfcad83b398a51cf60de429f1d2a5cdcbed06fa3b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
023e0ea5bd88f47efa1467b98d733aa8

SHA1
d2d13893c8dd34437a455437e8d6a46aea81029c

SHA256
d09b84aff3c5906c2da912605a3ccbeb18a134b8edfe34fdd17fc2dc5421ed7e

SHA512
87faa50ba8e7a980e3ed2e7ab7e6456baef8aa148099d4c65c8e9c7c624854d3eb2d290c3b34efd3511108854d75a878984bc5f3aa0441f1ddf3e79e6c1947aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a80f2ca219479aba911434789aab5d5

SHA1
47a738aac1a13c200c6a83d383dcc9cb5457325e

SHA256
ab6c2812c2bb8588a798c5d8155b8630ce47dda799e01fc847ed5a184417d9b7

SHA512
cd2c3c707d900305a5522e6b27b986840758b3ffad88ae73c7c5c6ab6779eae7d85264dd106430b3af72e98d11132f2a63b30a61d65dc3f6455e00a2534466fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
483fe388eb9690765c08330c838b3f4c

SHA1
dbd521b11f1033d1c32cc1eb7fe1f594588b7d76

SHA256
b0eaacd6bc3d33962bbc2bbdf4ee1974c8fab83a3879c72ba293761c29f6d839

SHA512
542a19ceb0aa40cdf1d7bb1cdd56d93368386170f463b579530c511edb0fa6cd6f99a6f676f0ca1589e0fbb809e1bf7654ab17fb67a444e5f29096f09b20e514

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06492b3a60ed96a4777b7caf77e20e53

SHA1
47f2daec5c325c92ac0a1bd3c3221cfe5d0d532e

SHA256
7f6c45256a9aa14ebbeed7eceb10bd294645438767d76082a8bb1b7d70ee3fed

SHA512
7941cf1c8900e86558e815635f323033c10a98a4b3805bb105e61ccc875903631d64a4596db3f754cd0d7e7b3549e51fc80719cccbc1d9e3770a9e097ebf9781

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF6DF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF9AF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit